8 confirmed signs, grouped by what they point to - the 1 known cheat is listed above with all of its records.

Each area is checked on its own. The ones where something turned up come first, the strongest at the top. Click an area to open its evidence.

An empty report can mean two things: nothing was there, or it was removed before the check. Anything that limits what this report could see is listed here.

Settings that can hide traces or interfere with the check.

Browser history, opened files and opened folders are kept per account. A check run from a different account than the one that played shows none of them - so this is where you see whether that happened. Machine-wide records (Amcache, ShimCache, Prefetch, the NTFS journal) cover every account.

Someone else playing through remote streaming, or the game running inside a virtual machine, can hide what happens on the real computer. DMA cards and other hardware cheats have their own card under Injection.

An exclusion means Defender no longer scans that place or file - the most common first step for a cheater.

Windows Defender keeps its own record of every threat it found, and that record outlives the file. A loader quarantined weeks ago is still named here. Ordinary malware is listed too, but marked as unrelated to cheating.

Programs holding an open connection to the internet at the moment of the check. Local network and loopback are left out. A cheat that was closed before the check leaves nothing here - this is the live picture, not history.

Known cheat sites that were visited, grouped across all browsers. Click a column to sort. Chrome and Edge keep about 90 days of history by default, so anything older is gone on its own - see What did not reach this report for whether it was cleared on purpose.

Expand a group to see the individual visits with URL and time.

Straight from the browser database - visible even if the file is already deleted. Only downloads matching a cheat site or name, coming from an anonymous file host, or scripts are listed. Ordinary software (VS Code, FiveM and so on) is hidden so the real findings stand out. Records reviewed in total: 11.

Programs Windows recorded as started, with the last run time and how many times. Renamed files are recognised by their contents while they are still on disk.

Everything the machine has ever executed (Amcache), including programs since deleted.

The NTFS journal keeps the exact deletion time. It is the only source that shows deleted files that were never executed - those never reach ShimCache or Amcache. USN journal active, 236,110 records reviewed.

When a file is opened Windows stores a shortcut with the full path - it survives deleting the file. Records reviewed: 10, of which the target is gone: 5.

Windows remembers every folder opened in Explorer - its name, its place and when it was last arranged. The record stays after the folder is deleted, so a folder that was emptied and removed before the check still shows up here. 1432 folder records were read; only those matching a cheat signature are listed.

Windows records every executable it encounters. The entry survives deleting the file and clearing Prefetch, which makes it one of the most durable proofs that a program was here. Files no longer on disk: 9.

Rules this server added itself. 3 rule(s) were part of this check. The severity is the one you chose - these are your words, not our signature list.

Files recognised as a known cheat, and unsigned programs recently placed in Downloads, Desktop or Temp - with signature, packing and compile time.

AutoHotkey, AutoIt, Python, JavaScript, Lua and other scripts. Python, AutoHotkey and AutoIt are also read: a script that captures the screen and clicks the mouse on a key is how colorbots and triggerbots work, even when it never touches the game.

Logitech G HUB and similar tools allow Lua scripts that drive the mouse - the most common no-recoil method, invisible to both module and file scanning. Only the folders of these programs are scanned. Records found: 1.

Serious cheats run in the kernel where user-level checks cannot see them. To get there they must either relax signature enforcement (testsigning, nointegritychecks) or abuse a vulnerable signed driver (BYOVD). Both leave traces.

Clearing a log is deliberate trace removal. Driver installs show where kernel code was loaded from. Install records reviewed: 0, of which kernel drivers: 0 - only those installed outside system folders are listed.

Paid cheats load their DLL straight into memory, bypassing the Windows loader, so the module never appears in the module list. The scan looks for executable private memory with a valid PE header; JIT compilers (browsers, .NET) never build PE headers, so they are not counted.

Regions inspected: 48,221, executable private regions (JIT and similar): 37.

The scan looks for anomalies, not known names: unsigned DLLs loaded into the game from temp or download folders. That catches new, still unknown cheats too. Signatures are verified through Windows (catalog signatures included).

1 game process checked, 2 modules worth attention.

An external cheat injects nothing - it reads the game's memory from its own program, or writes into it, and shows what it found in its own see-through window over the game. Both are visible: the handle Windows gives it to the game, and the always-on-top, click-through window. Signed programs (Steam, Discord, overlays, recorders, antivirus) are listed for context and never counted.

The game was not running during the check, so nothing could hold it open.

Cheats usually load through a proxy DLL (dinput8, version, d3d11 and so on) or an ASI loader placed next to the game. Folders checked: 0, files found: 1 (original signed game files are marked INFO).

No game folders found - nothing to check.

Logs: 0, crashes: 0. A failed injection often crashes the game; missing logs are a sign of cleaning. Game engine noise (such as CCheat, an original GTA V system) is ignored.

State of the NTFS deletion journal, PowerShell command history, Explorer searches and connected USB drives. These traces remain even when the files are gone. Records in total: 4.

Every area has its own time limit so the check cannot hang forever on one slow machine. Anything that ran out of time or failed is listed here - those areas are covered only in part, and a clean result there means less than elsewhere. The whole check took 440 s.

Grouped by type, most important first. Browser hits and system warnings are not repeated here - they have their own sections above.